Im looking to write a script that will will notify me via email , and/or by printed reported when a certain user, logs in, tries to access a restricted directory, or when the user is trying to login and password has failed more than 3 consecutive times. Any help is greatly appreciated. Thanks in advance.

Okay, I know this post is old, but I hate unanswered posts! In case anybody is sitll interested in an answer to this question, here's a script that I used to use to block IP's with excessive ssh login failures. You may need to change some things depending on what flavor of *NIX you run it on. In its current configuration, it should work on a RedHat Enterprise 3 system, and will add any IP address with 10 login failures (since the log was rotated, which was daily in my case) to a block list, and send an email notification.

I also had some firewall rules in there originally, but I cut them out for this exercise. It could be easily modified to get usernames as well, and you could use the log that it generates as your printed report! Let me know if it's useful.

############################################ Use 'exec' to direct the output of## the tmpfile to 'read' in our next## loop##########################################

exec < $TMPFILE

############################################ Use 'read' to break out the ip and## the number of occurrences, check## for existence in block list, and## block if necessary##########################################

while read COUNT IPADDR ; do ## Check to see if the IP is already in the list PRE=$(grep $IPADDR $BLOCKLIST)

## If it's not in the list... if [ -z "$PRE" ]; then

## And it occurs greater than or equal to $MAX_TRY times... if [ "$COUNT" -ge "$MAX_TRY" ]; then

I've got to find my old backups... A lot of the stuff I have is specific to the Plesk and Ensim control panels... My web site is something else that's been neglected... It's been "under construction" for about a year now

Who is online

Users browsing this forum: Bing [Bot] and 18 guests

You cannot post new topics in this forumYou cannot reply to topics in this forumYou cannot edit your posts in this forumYou cannot delete your posts in this forumYou cannot post attachments in this forum